This video provides a step-by-step guide on how to replace the default self-signed certificate on Cisco ISE with a certificate signed by an external root Certificate Authority (CA). This is crucial for enhancing network security and ensuring continued access to Cisco ISE functionalities, as self-signed certificates can expire and cause trust issues for endpoints and administrators.
Here are the step-by-step instructions for integrating an external certificate with Cisco ISE, as demonstrated in the video:
Download the Root CA Certificate:
root CA.crt).Import the Root CA Certificate into Cisco ISE:
Administration > Certificates > Trusted Certificates.Import.binaryavenue root CA).Client Authentication, Base Cisco Services. You can select all relevant options.Submit.Generate a Certificate Signing Request (CSR) in Cisco ISE:
Administration > Certificates > Certificate Signing Requests.Generate Signing Request.Multi-Use for the certificate type, as it will be used for various functions.Node (e.g., IO1).Common Name (CN), which should be the Fully Qualified Domain Name (FQDN) of your ISE node (e.g., io1.binaryavenue.com).Organization Unit and Organization fields as needed.Subject Alternative Name (SAN):
192.168.1.4321).Generate.Export the CSR:
Export.Request Certificate Signing from the Root CA:
Advanced Certificate Request option.Certificate Template as Web Server.Download the Signed Certificate:
Base 64 format.certificate signed by root CA.crt).Bind the Signed Certificate in Cisco ISE:
Administration > Certificates > Certificate Signing Requests.Bind Certificate option.IO1 sign certificate).Usage for the certificate:
EP AuthenticationRADIUS DTLSPX Grid (if applicable)Eye Messaging ServicePortal (select all portal options, including guest services if needed).Admin usage, as this will cause the Cisco ISE application to restart. It's recommended to perform this during a maintenance window.Submit. You may receive warnings about replacing the certificate and the application restarting. Confirm these actions.Verify the New Certificate:
Administration > Certificates.